Understanding why full and quick scans are out of 7 days

Question

Hi,

We have been receiving security recommendations for our virtual machines, and one of the findings states that "Both full and quick scans are out of 7 days":

EDR configuration issues should be resolved on virtual machines-> Findings-> Both full and quick scans are out of 7 days

The details indicate:

{
    
    
        
        
    }
}

The defender plan sor Servers is Plan2:

I would like to understand:

1. Where does this security recommendations come from?
2. Why a quick scan is not automatically performed when the option "agentless scanning for machines" is set to ON?
3. How to solve it?

Thanks

Answer 1

Hi @Quattrocchi, Calogero ,

The details you shared are blank. Are the details truly empty or did they not copy/paste into your post? Aso, do you have all of the prerequisites met for agentless scanning for machines? If you see the finding "Both full and quick scans are out of 7 days", you need to investigate under the "Recommendations" section and follow the remediation steps documented here. If you've already resolved any EDR recommendations, it can take up to 24 hours for the changes to reflect.

Note also that you need to meet the prerequisites highlighted in the article in order to view the recommendations:

• Defender for Cloud enabled on your Azure account.
• You must have either of the following plans enabled on Defender for Cloud enabled on your subscription:
  • Defender for Servers plan 2
  • Defender Cloud Security Posture Management (CSPM)
• You must enable agentless scanning for virtual machines.

If you are not seeing information in the "Additional Information" section, feel free to reach out to me at AzCommunity@microsoft.com ("Attn: Marilee Turscak") and include your subscription ID and a link to this thread. That way we can further troubleshoot and I can open a one-time free support case to look into this issue.

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching similar questions.

Answer 2

Hi,

Sorry the copy paste did not work (see below now the additional information).

We meet all prerequistes as mentioned above.

However, the reommendation is still present after more than 24 hours:

"Both full and quick scans are out of 7 days"

Why there is no automatic quick scan in place for the VMs?

How to allow this automatic quick scan?

Thanks

Regards.

{
    "assessedResourceType": "GeneralVulnerability",
    "data": {
        "LastQuickScanDate": "No quick scan date found",
        "LastFullScanDate": "No full scan date found"
    }
}